Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Am I doing something wrong or is the AWS VPC ec2 instances not able to reach any of the AWS managed services (s3/sns/sqs) without a public route to the Internet Gateway in the routetable?

I was told here Aws vpc default route table in CloudFormation that AWS VPC default routetable has no public route by default so it can "protect" the VPC.

But if I can't access AWS services without a public route... That just defeats the purpose as I would be practically adding public route to all the routetables?

share|improve this question

2 Answers 2

up vote 4 down vote accepted

Am I doing something wrong or is the AWS VPC ec2 instances not able to reach any of the AWS managed services (s3/sns/sqs) without a public route to the Internet Gateway in the routetable?

That's correct. If you need to use those services, your instances will need EIPs or you'll need a NAT host in your VPC. A VPC is truly private, and it operates in the same manner a well-maintained corporate network does: only allowing traffic that you explicitly allow.

It's worth noting: managed services like RDS, Elasticache, Redshift, etc, can indeed run within your VPC.

share|improve this answer
    
Thanks for the confirmation. Urghhhh.... –  Sleeper Smith Apr 22 '14 at 3:30

AWS recently (May 2015) added support for VPC endpoints for S3, which lets you use S3, at least, without public Internet access.

AWS state in the user guide that they will add VPC endpoints for more services in the future.

share|improve this answer
    
good update. I can't wait till all the service endpoints are available >:) –  Sleeper Smith Jul 26 at 8:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.